v1.36.3

envoyproxy/envoyv1.36.3Dec 4, 2025by publish-envoy[bot]

AI Summary

This release addresses security vulnerabilities including a crash when JWT authentication uses remote JWKS fetching, incorrect handling of TLS certificates with null bytes, and potential request smuggling via early data.

Key Highlights

Fixes crash when JWT auth is configured with remote JWKS fetching (CVE-2025-64527)
Fixes TLS matcher for match_typed_subject_alt_names with embedded null bytes (CVE-2025-66220)
Fixes potential request smuggling from early data after CONNECT upgrade (CVE-2025-64763)

Full Release Notes

**Summary of changes**:

* Security fixes:
  - [CVE-2025-64527](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866): Envoy crashes when JWT authentication is configured with the remote JWKS fetching
  - [CVE-2025-66220](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p): TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
  - [CVE-2025-64763](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jh): Potential request smuggling from early data after the CONNECT upgrade

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.3
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.36.3/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.36.3/version_history/v1.36/v1.36.3
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.36.2...v1.36.3

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Boteng Yao <boteng@google.com>